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APOLLO EXPERIENCE REPORT 

GUIDANCE AND CONTROL SYSTEMS: 

LUNAR MODULE MISSION PROGRAMER 

By Jesse A. Vernon 
Lyndon B. Johnson Space Center 

SUMMARY 


The lunar module mission programer was designed to enable the lunar module 
to meet the requirements for unmanned near-Earth orbiting missions and to be adapt- 
able to restricted unmanned lunar landing missions within the capability of the ultra- 
high -frequency/very -high -frequency communication links if adequate command and 
service module transmission capability were provided. An onboard lunar module 
mission programer would not preclude a manned mission involving two crewmembers. 

The mission programer was used for sequencing functions in an unmanned space- 
craft to prove proper functioning of the system and to ensure spacecraft readiness for 
manned flights. The lunar module mission programer was composed of the following 
functional components: (1) a program reader assembly, (2) a digital command assem- 
bly, (3) a program coupler assembly, and (4) a power distribution assembly. 

The functional components of the mission programer were subjected to design- 
feasibility, design -verification, and qualification tests. The units successfully com - 
pleted all tests with only minor problems. However, from the beginning of the program, 
the program coupler assembly was plagued with relay problems, many of which 
were a direct result of contamination inside the sealed relay can. Others were unex- 
plained — no contamination or other causes of failures were ever found. 

The lunar module mission programer performed all the required functions 
throughout the Apollo 5 mission. From lift-off until 6 minutes 10 seconds into the 
flight, the programer was operated in the primary mode with the guidance computer in 
control; then the backup mode was activated, and the programer controlled all sequenc- 
ing throughout the mission. The lunar module mission programer was flown on only 
one mission. A modified mission programer, the ascent -engine arming assembly, was 
flown on the Apollo 9 and 10 missions. This assembly permitted the ascent engine to 
be armed after crew departure and to be fired to fuel depletion after the ascent stage 
was separated from the command and service module. 



INTRODUCTION 


Electrical and electronic equipment has been used in many areas to perform 
functions previously performed by man. Technologists have continued to develop 
automated techniques and have extended the scope to include the sequencing of functions 
in an unmanned spacecraft to prove proper functioning of the system and to ensure 
spacecraft readiness for manned flights. The lunar module mission programer (LMP) 
is one such device. The LMP concept, design, development, and flight performance 
are described in this report. The LMP was flown on only one mission (Apollo 5/lunar 
module 1 (LM-1)) and performed all required functions when it was activated 6 minutes 
10 seconds after lift-off. 

As an aid to the reader, where necessary the original units of measure have 
been converted to the equivalent value in the Systeme International d’Unites (SI). The 
SI units are written first, and the original units are written parenthetically thereafter. 


CONCEPT 


The LMP was designed to enable the LM to meet the requirements for unmanned 
near -Earth orbiting missions and to be adaptable to restricted unmanned lunar landing 
missions within the capability of the ultra -high -frequency (uhf) /very -high -frequency 
(vhf) communications links if adequate command and service module (CSM) transmis- 
sion capability were provided. An onboard LMP would not preclude a manned mission 
involving two crewmembers. 


OPERATIONAL REQUIREMENTS 


The operational requirements of the LMP were as follows: 

1. Noncontingency mission performance without ground -command control of 
unmanned flights 

2. Nonsimultaneous manned and LMP system operation on the same flight 
(manned operation possible before LMP activation and after LMP deactivation) 

3. Control of LM subsystems as required to control functions in an optimum 
manner to meet flight test objectives 

4. Ground-command selection of alternate test sequences in the backup mode 
or in the primary mode (within the capacity of the LM guidance computer (LGC)) 

5. Priority of ground command over onboard command 

6. One LMP configuration compatible with all unmanned mission operations 
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EQUIPMENT DESCRIPTION 


The LMP consisted of the following functional components: (1) a program reader 
assembly (PRA), (2) a digital command assembly (DCA), (3) a program coupler 
assembly (PCA), and (4) a power distribution assembly (PDA). The PRA contained 
a contingency program to be used if the primary mode failed or if special subsystem 
contingency operations became necessary. The DCA provided an uplink capability so 
that ground commands could be routed to the LGC, the PRA, or the PCA. The PCA 
provided coupling of the LGC, PRA, and certain DCA commands to control the basic 
LM subsystems. The PDA provided the dc power distribution and current protection 
for the LM components. 


Program Reader Assembly 

The PRA was programed to contain commands to provide open -loop backup 
sequencing if a failure was detected by the primary guidance, navigation, and control 
system (PGNCS). The PRA provided only those commands necessary to operate the 
LM subsystems for LM testing after a primary -mode failure. It did not provide 
vehicle guidance or attitude information. The PRA consisted of three subassemblies: 

(1) a power supply subassembly, (2) a tape reader subassembly, and (3) a program 
control subassembly. 

The power supply subassembly provided the internal voltages required for PRA 
operation and supplied isolation of signal and power grounds within the PRA. It also 
protected the PRA from damage resulting from abnormal vehicle conditions. 

The tape reader subassembly was a bidirectional reader using programed tape. 
The tape was capable of storing a maximum of 64 000 bits of information. The stored 
information was sensed by a read head. A tape "hole" was a binary one; a tape 
"no hole" was a binary zero. Capability to sense the beginning and end of the tape 
was incorporated in the PRA. 

The program control subassembly was used to select, control, and issue — 
as a function of time — the information stored in the PRA. External control commands 
were provided to the PRA by means of uplink commands through the DCA. The pro- 
gram control subassembly placed the PRA in the standby mode or the normal (either 
search or readout) mode. To inform the ground station that the PRA was sequencing, 
the program control subassembly provided a "compare" pulse and, in the readout mode, 
transmitted a 1 -pulse/sec clock pulse to the ground. 


Digital Command Assembly 

The DCA received, decoded, and processed commands received from the ground by 
uhf transmission. These commands were sent to the LGC to accomplish limited pro- 
gram control, to the PRA to enable selection and initiation of a segment of the PRA 
program, or to the ground relay matrix of the PCA to accomplish real-time control 
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of certain functions of the LM subsystems. The DCA also had a self -test and veri- 
fication capability controlled by the Manned Space Flight Network. The DCA consisted 
of a uhf receiver, two decoders (redundant), a phase -shift -keying (PSK) demodulator, 
and a power supply. 

The uhf receiver was a miniaturized solid-state, double -conversion, superhet- 
erodyne device that received and demodulated frequency -modulation/PSK signals 
in the uhf band. The decoder decoded digital messages from the PSK demodulator 
and allowed partial messages from the residue of rejected messages to be received 
without transferring them to associated assemblies. The PSK demodulator converted 
the PSK signal from the receiver into a series of digital bits for the decoder and also 
provided a set of reference clock pulses for the decoder. The power supply provided 
the regulated power and signal ground isolation required for DCA operation. 


Program Coupler Assembly 

The PCA received commands from the LGC, the PRA, or the DCA and coupled 
these commands to the LM subsystems by means of magnetic latching relays. Each 
relay contained two directional diodes and was half -crystal can size. The PCA con- 
sisted of a decoder subassembly, a power supply subassembly, and a switching sub- 
assembly. The decoder subassembly selected and decoded command words from the 
LGC or the PRA. The LGC command word contained 12 bits (4 address bits and 8 data 
bits). The PRA command word contained only 8 data bits. The power supply subassem- 
bly provided the regulated power required for PCA operation and for isolation of power 
and signal grounds within the PCA. The switching subassembly contained two matrices 
of latching relays. The prime matrix was controlled by the LGC or PRA output com- 
mands by means of the decoder subassembly. These relays were controlled on a real- 
time basis. The real-time command relays were used to correct or compensate for 
failures of the programed relays and to correct or compensate for certain LM subsys- 
tem failures. The switching subassembly also contained the uplink -activated interlock- 
ing relays to allow ground -control priority if a PCA prime relay failed. These relays, 
when activated, disabled specific control circuits in the LMP prime -relay matrix. 


Power Distribution Assembly 

The PDA provided dc power distribution and current protection for the DCA, the 
PCA, and the PRA and provided the dc power required for LMP control of the ac 
inverters. The PDA contained manually operable circuit breakers that enabled and 
disabled the LMP. Additional relays performed high-power switching functions 
required for proper LM operation. These relays were controlled by relays in the PCA. 


DESIGN 


The LMP was designed and constructed to satisfy the individual specification 
requirements of structural and electrical design and of performance. 
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The calculated reliability goal for a DCA was met through the use of redundancy 
in the digital decoder section only. A self -checking and fail-safe feature was included 
to prevent an invalid message from performing a function. Integrated circuits were 
used wherever possible in designing the DCA because of their high reliability, low 
power consumption, small size, and light weight. Discrete components were used in 
those areas in which the circuit constraints precluded the use of integrated circuits. 

The PCA design goal was to achieve high reliability. To accomplish this goal, 
numerous broad-based design objectives — such as minimum weight, optimum thermal 
design, high packaging density, and adaptability to design changes — were met early 
in the PCA design. 

The minimization of weight was a prime consideration. The following design 
concepts were used to fulfill the rigorous environmental and operational requirements 
effectively while maintaining the concept of minimum weight. 

Integrated circuits were used instead of discrete components where practical. 

A single flatpack performed the task of approximately 34 discrete components with 
obvious weight-saving results. Welded-wire cordwood assemblies were used, where 
practical, rather than conventional solder. This procedure added reliability to the 
electrical junction and provided substantial weight savings. All parts used represented 
the state-of-the-art high-reliability versions of products being manufactured at the 
time. 


To provide the best possible thermal path from heat -dissipating parts to the 
mounting flange, all parts and components were bonded directly to the module web 
with an adhesive having high thermal conductivity. All cordwood assemblies were 
completely encapsulated. The encapsulant then paralleled the path of the part lead, 
which resulted in a further reduction in thermal resistance. 

Every effort was made to design a package that incorporated high -density design 
concepts. In many cases, the electrical requirements and the available parts limited 
the miniaturization effort (i. e. , transformers, chokes, capacitors, relays, etc.). 

Because of the nature and functions of the PCA, the conceptual design within the 
PCA and the several interfacing electronic assemblies changed. Therefore, designing 
the PCA to accept these changes was difficult. The use of flexible harness and the 
inclusion of spare terminals on each module to provide the simplest means for exe- 
cuting changes are examples of the adaptability to design changes. If a hardwired 
multilayer or printed circuit board (mother board) had been used, a complete redesign 
would have been necessary to incorporate a change in module interwiring. 

The PRA had an integrated planar photodiode array, which was used to read 
digital data stored on 35 -millimeter photographic film. The tape (photographic film) 
was advanced by a simple step servosystem that required a minimum number of 
moving parts and gears. The tape -transport system, drive sprockets, and supply 
and takeup spools were identical in concept to the components and system used in 
space -flight -proven programers. The programed film was, for all practical pur- 
poses, indestructible. This was not true for magnetic-tape and magnetic-core systems 
in which the data can be inadvertently erased. The decision to use a photoelectric 
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readout was based primarily on a program to develop an integrated planar photodiode 
array that was significantly more reliable than any existent reader. The program 
tape had an end-of-tape word that, when sensed, stopped either the forward or reverse 
search mode. The end-of-tape word was repeated three times; hence, a forward or 
reverse search command issued in the same direction after the word was first sensed 
could cause the program tape to unwind off the tape spool. The corrective action to 
minimize program impact was to repeat the end-of-tape word many times, which 
would make unwinding the tape from the tape spool almost impossible. 


DEVELOPMENT 


Developmental tests were performed to provide data that were used to support 
the design of a specific component or subassembly. Developmental tests were also 
used to determine operating characteristics under off -design conditions. In conjunc- 
tion with the general thermal design, developmental tests were performed on the equip- 
ment in a simulated thermal environment to ensure that the thermal requirements had 
been satisfied. Developmental tests were categorized as design-feasibility tests and 
design -verification tests. 

The design-feasibility tests included all tests performed for the following 
purposes: 

1. Selection of components and parts 

2. Investigation of the performance of breadboard models, components, and 
subassemblies under various environmental conditions 

3. Selection of materials 

4. Substantiation of safety margins or of other analytical assumptions 

The design-verification tests were performed on two production models in simu- 
lated ground and flight environments and under off -design conditions to determine 
whether the design would meet mission requirements. The equipment was subjected 
to numerous environmental conditions. No replacement of parts, adjustments, or 
maintenance was permitted during design -verification testing. Successful completion 
of these tests, excluding overstress, was a prerequisite to the start of qualification 
tests. 


QUALIFICATION 


Qualification tests were performed on two production units to demonstrate attain- 
ment of design objectives, including margins of safety. The qualification test was 
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performed in two separate phases: (1) the design-limit test (equipment subjected to 
test -sequential, singly applied environments at design -limit conditions), and (2) the 
endurance test (equipment subjected to one operational cycle and one subsequent 
mission cycle at nominal mission conditions). 


Program Reader Assembly 

The PRA, part number LSC-300-72, had the following physical parameters: 
weight, 6.24 kilograms (13. 75 pounds); length, 24.64 centimeters (9. 7 inches); width, 
13 centimeters (5. 12 inches); and height, 17. 8 centimeters (7.0 inches). The PRA 
was subjected to the qualification test in accordance with the test plan (Certification 
Test Requirement (CTR) LCQ- 300-005). Each of the qualification -test programs 
(design limit and endurance) was successfully implemented in accordance with the 
applicable specified requirements and was approved with no deviation or waiver 
requested or issued. Data generated during the performance of the qualification - 
test programs indicated that each PRA successfully completed all the requirements 
specified for operation and performance during acceptance testing with no waivers or 
deviations. 


Power Distribution Assembly 

The PDA, part number LDW-390-28153-1, had the following physical param- 
eters: weight, 4.08 kilograms (9 pounds); length, 64.77 centimeters (25.5 inches); 
width, 17. 15 centimeters (6. 75 inches); and height, 19. 68 centimeters (7. 75 inches). 
The PDA was subjected to the qualification test in accordance with test plan 
LTP-390-15 (CTR LCQ-390-015). 

The test article was initially configured with a polyurethane collar between the 
circuit breaker panel and the main assembly of the PDA. The purpose of the collar 
was to provide vibration isolation to the MS -type circuit breakers. After the success- 
ful completion of these tests, data from the lunar test article 3 (LTA-3) vibration 
test indicated that significantly lower vibration levels should have been used. Testing 
at the lower vibration levels indicated that the vibration isolation provided by the poly- 
urethane collar was not required. In consideration of the potential fire hazard of 
polyurethane and of the reduced vibration levels, the polyurethane collar was elimi- 
nated, the circuit breakers were hard mounted, and the PDA was successfully tested 
in a supplemental qualification test. 


Program Coupler Assembly 

The PCA, part number LSC-300-710-5, had the following physical parameters: 
weight, 23.59 kilograms (52 pounds); length, 70.49 centimeters (27.75 inches); 
width, 13.018 centimeters (5.125 inches); and height, 19.05 centimeters (7.5 inches). 
The PCA was subjected to the qualification test in accordance with test plan 
LTP -303-20 (CTR LCQ-300-004). 
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A number of relay failures occurred on the qualification endurance assembly. 
These were of two types: shorts to case caused by contaminants (tipoff pin) inside 
the relay case and shorts to case caused by the diode leads. 

The changes incorporated into the high -reliability -type relay to prevent these 
kinds of failures were as follows: 

1. A new tipoff pin was used that had a head large enough to prevent it from 
dropping into the relay case. 

2. Two layers of insulating Mylar were put on the coil -diode assembly to pre- 
vent possible shorts of diodes to the case. 

3. Different assembly techniques were applied to the coil-diode unit, and more 
rigid inspections were used to eliminate any possibility of an internal diode in the 
relay shorting to a coil. 

It was recommended that the PCA be requalified because of the relay failures 
that occurred during the qualification test. The requalification testing was consistent 
with the requirement not to jeopardize the status of the particular PCA unit as a flight 
spare. The requalification or delta -qualification test was aborted on the first start 
because of two relay failures, one of which could not be explained. The second attempt 
at the delta-qualification test was completed with one failure (attributed to contami- 
nation). The delta -qualification test was abbreviated to preserve the flight integrity 
of the particular PCA unit. It should be noted that there was never a functional fail- 
ure of this particular PCA unit; that is, there was never a failure of a redundant relay 
and a primary relay that caused the loss of a function. Therefore, the decision was 
made that this particular unit was flight qualified. 


Digital Command Assembly 

The DCA, part number 380-0050, had the following physical parameters: 
weight, 6.24 kilograms (13.75 pounds); length, 29.85 centimeters (11.75 inches); 
width, 17. 15 centimeters (6. 75 inches); and height, 17. 78 centimeters (7. 0 inches). 

The DCA was subjected to the qualification test in accordance with test plan LTP- 
4614-11 (CTR LCQ-380-005). 

Each of the qualification-test programs (design limit and endurance) was com- 
pleted; however, three failures occurred during these tests. These failures were 
related in nature and were traced to a workmanship problem that involved (1) an open 
weld connection (discovered during vibration testing) and (2) a loose cordwood (a potted 
module) that caused breakage of interconnecting leads (also discovered during vibra- 
tion testing). The vibration spectrum exceeded the specification levels except for a 
small portion in the high-frequency region. However, the test levels always remained 
above the actual LTA-3 vibration levels, which were used to check validity of require- 
ments. After the two qualification models were modified, no further deviations were 
necessary, and the tests were successfully completed. 
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RELIABILITY AND QUALITY CONTROL 


A reliability and quality -control program was established for the LMP in accord- 
ance with NASA publications NPC-200-2 and NPC-200-3. The implementation of this 
program included inspections and testing to determine conformance of the system to 
contractual and specification requirements before submission of the article to NASA 
for acceptance. Identification and traceability were controlled in accordance with the 
approved quality -control program. Quality -control procedures were also implemented 
to ensure interchangeability, as required. A reliability program was also implemented 
in accordance with NASA reliability publication NPC -250-1 and the LM - contractor - 
approved reliability program plan (LPL -550-1). 

MISSION PERFORMANCE 


The LMP performed all required functions throughout the Apollo 5 mission (the 
only mission on which a complete LMP, as previously described, was flown). From 
lift-off until 06:10:00 ground-elapsed time (GET), the LM was operated in the primary 
mode with the LGC in control. At 06:10:00 GET, the backup mode was activated. In 
this mode, the LMP controlled all sequencing. Sequences HI and V were used. 
Periodically throughout the mission, the ground-command capability was used; and, 
except for periods of abnormal signal strength, performance was nominal. Abrupt 
changes of approximately 34 decibels in spacecraft -received uhf -signal strength were 
detected throughout the mission. These abrupt changes in received power frequently 
caused the command signal to be below the message -acceptance threshold. Corre- 
sponding changes did not occur in the ground-received signal strength from the vhf 
data transmitters that shared the same antennas through a diplexer. Consequently, 
command transmission had to be delayed or repeated. The variations in received 
signal power were consistent with an intermittent condition in the DCA radiofrequency 
stage, in the coaxial-cable assembly connecting the diplexer and DCA, or in the inter- 
nal diplexer connections. 

On subsequent missions (Apollo 9 and 10), a modified LMP was used. The 
Apollo 9 LMP consisted of the DCA and the ascent-engine arming assembly (AEAA). 
The AEAA permitted the ascent engine to be armed and to be fired to fuel depletion 
after ascent-stage separation from the CSM. The Apollo 10 LMP consisted of the 
digital uplink assembly, which replaced the DCA, and an AEAA of a different config- 
uration. This AEAA performed the same function on the Apollo 10 mission that the 
AEAA did on the Apollo 9 mission. In addition, it contained a provision for switching 
the guidance from the PGNCS to the abort guidance system after the ascent engine was 
started for the burn-to-depletion maneuver. 
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CONCLUDING REMARKS 


Data from the design -verification test, the qualification test, and the subsequent 
vehicle tests as well as data from the mission show that the lunar module mission 
programer fulfilled all design requirements. 

After qualification testing, the program reader assembly had one anomaly that 
might warrant one minor design change if the unit were to be redesigned. The program 
tape had an end -of -tape word that, when sensed, stopped either the forward or 
reverse search mode. The end-of-tape word was repeated three times; hence, a 
forward or reverse search command issued in the same direction after the word was 
first sensed could cause the program tape to unwind from the tape spool. The correc- 
tive action to minimize program impact was to repeat the end-of-tape word many 
times so that it was almost impossible to unwind the tape from the spool. If the unit 
is redesigned, a more positive end-of-tape sensor should be incorporated. 

The program coupling assembly was plagued with relay problems from the 
beginning of the program. Many of the problems were a direct result of contamination 
inside the sealed relay can; others were unexplained problems in that no contamination 
or other causes of failures were ever found. 

Each relay contained two directional diodes and was half-crystal can size. 
Therefore, the relay complexity was greatly increased. Two recommendations for 
redesigning the relays are that (1) the switching matrix should be a solid-state device 
and (2) the directional diodes should remain outside the relay can if the relay is to be 
used in the switching matrix. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, September 9, 1974 
914-50-00-00-72 


10 


NASA-Langley, 1975 


S-414 


NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 
WASHINGTON, D.C. 20546 


OFFICIAL BUSINESS 

PENALTY FOR PRIVATE USE $300 SPECIAL FOURTH-CLASS RATE 

BOOK 


POSTAGE AND FEES PAID 
NATIONAL AERONAUTICS AND 
SPACE ADMINISTRATION 
451 



POSTMASTER : 


If Undeliverable (Section 158 
Postal Manual) Do Not Return 


"The aeronautical and space activities of the United States shall be 
conducted so as to contribute ... to the expansion of human knowl- 
edge of phenomena in the atmosphere and space. The Administration 
shall provide for the widest practicable and appropriate dissemination 
of information concerning its activities and the results thereof ” 

— National Aeronautics and Space Act of 1958 


NASA SCIENTIFIC AND TECHNICAL PUBLICATIONS 


TECHNICAL REPORTS: SciemiSc and 
technical information considered important, 
complete, and a lasting contribution to existing 
knowledge. 

TECHNICAL NOTES: Information less broad 
in scope but nevertheless of importance as a 
contribution to existing knowledge. 

TECHNICAL MEMORANDUMS: 

Information receiving limited distribution 
because of preliminary data, security classifica- 
tion, or other reasons. Also includes conference 
proceedings with either limited or unlimited 
distribution. 

CONTRACTOR REPORTS: Scientific and 
technical information generated under a NASA 
contract or grant and considered an important 
contribution to existing knowledge. 


TECHNICAL TRANSLATIONS: Information 
published in a foreign language considered 
to merit NASA distribution in English. 

SPECIAL PUBLICATIONS: Information 
derived from or of value to NASA activities. 
Publications include final reports of major 
projects, monographs, data compilations, 
handbooks, sourcebooks, and special 
bibliographies. 

TECHNOLOGY UTILIZATION 
PUBLICATIONS: Information on technology 
used by NASA that may be of particular 
interest in commercial and other non-aerospace 
applications. Publications include Tech Briefs, 
Technology Utilization Reports and 
Technology Surveys. 


Details on the availability of these publications may be obtained from: 

SCIENTIFIC AND TECHNICAL INFORMATION OFFICE 

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 


Washington, D.C. 20546 




